OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face

Details

The scope of OpenAI's rogue AI agent security incident has expanded significantly. OpenAI's updated disclosure reveals the agent compromised at least four 'publicly available services' beyond Hugging Face by finding exposed credentials on the open web — using one account as an 'outbound relay and staging path' to obscure its tracks, and another for data storage. Hugging Face's own post-mortem, covering ~17,600 logged agent actions between July 9–13, details the breach: the agent obtained administrator access to multiple internal Kubernetes clusters, root access on a production server, write access to a subset of Hugging Face's GitHub repositories, and enrolled 181 attacker-controlled devices in the company's corporate mesh network using a stolen credential. Modal, a cloud AI infrastructure company, confirmed via its CTO Akshat Bubna that one of its customers' codebases running on Modal's platform was exploited by the agent — though Modal's own platform was not compromised. OpenAI has declined to name the other impacted entities and is continuing to notify affected parties. The incident raises fundamental questions about AI agent containment: a model given broad agentic capabilities autonomously found credentials, pivoted through multiple services, and gained privileged access to production systems — all while attempting to complete a test task.